# Revision history [back]

The problem seems to be that packet-ethertype.c:dissect_ethertype() expects to be passed a pointer to an ethertype_data_t. Since there appears to be no way to pass this data to the dissector from a Lua dissector, dissect_ethertype() rejects it since the data is NULL.

I don't know any way around this problem except to open a bug report and see if someone can add support for this, or to rewrite the f2 shim as a built-in C dissector and ideally submit it for inclusion into Wireshark.

(Incidentally, the comment for dissect_ethertype() is wrong and should be fixed.)

So in theory, the f2 shim Lua dissector would look something more like so:

f2_shim = Proto ("f2_shim", "Cisco F2 shim header")
index = ProtoField.uint16("f2_shim.index", "Index", base.HEX)
data =  ProtoField.uint64("f2_shim.data", "Data", base.HEX)
f2_shim.fields = {index, data}

function f2_shim.dissector(buffer, pinfo, tree)
local etype_data = nil -- The "magic" piece we can't use from Lua

pinfo.cols.protocol = "f2_shim"
local subtree = tree:add(f2_shim, buffer(0, 10))
--[[
In theory, we'd initialize and pass a pointer to etype_data,
consisting of:
etype
fh_tree
trailer_fd
fcs_len
--]]
Dissector.get("ethertype"):call(buffer:range(10):tvb(), pinfo, tree, etype_data)
end

ether_table = DissectorTable.get("ethertype")


The problem seems to be that packet-ethertype.c:dissect_ethertype() expects to be passed a pointer to an ethertype_data_t. Since there appears to be no way to pass this data to the dissector from a Lua dissector, dissect_ethertype() rejects it since the data is NULL.

I don't know any way around this problem except to open a bug report and see if someone can add support for this, or to rewrite the f2 shim as a built-in C dissector and ideally submit it for inclusion into Wireshark.

(Incidentally, the comment for dissect_ethertype() is wrong and should be fixed.)

So in theory, the f2 shim Lua dissector would look something more like so:

f2_shim = Proto ("f2_shim", "Cisco F2 shim header")
index = ProtoField.uint16("f2_shim.index", "Index", base.HEX)
data =  ProtoField.uint64("f2_shim.data", "Data", base.HEX)
f2_shim.fields = {index, data}

function f2_shim.dissector(buffer, pinfo, tree)
local etype_data = nil -- The "magic" piece we can't use from Lua

pinfo.cols.protocol = "f2_shim"
local subtree = tree:add(f2_shim, buffer(0, 10))
--[[
In theory, we'd initialize and pass a pointer to etype_data,
consisting of:
etype
fh_tree
trailer_fd
fcs_len
--]]
Dissector.get("ethertype"):call(buffer:range(10):tvb(), pinfo, tree, etype_data)
end

ether_table = DissectorTable.get("ethertype")

Lastly, since there seems to be some confusion about this f2 shim, here's some packet data that can be converted to a pcap file using text2pcap for testing, e.g., text2pcap f2_shim.txt f2_shim.pcap. It adds an f2 shim with index=1 and data=0xdeadbeefdeadbeef, at least as I understand the format and placement of the f2 shim to be. The real payload should be dissected as IP (carrying UDP), but it isn't due to the limitations described above:
0000   00 0e b6 00 00 02 00 0e b6 00 00 01 f0 01 00 01